skills.rest
fastrevmd-lab
fastrevmd-labCOMMUNITY
Explore all skills by this author →
GitHub

srx-advpn

Design, configure, and troubleshoot Juniper SRX ADVPN spoke-to-spoke IPsec shortcut deployments.

9|Updated Mar 7, 2026
Search Tags:#pki#junos#ipsec#vpn troubleshooting#juniper srx#ikev2#advpn
One-click install
npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill srx-advpn-fastrevmd-lab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: srx-advpn
Source: https://github.com/fastrevmd-lab/fwskillsshare/tree/main/skills/srx-advpn
Command: npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill srx-advpn-fastrevmd-lab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Juniper SRX ADVPN deployments fail in non-obvious ways: PSK authentication that cannot commit, IKE_AUTH loops over NAT-T, and a dynamic-gateway certificate defect that rejects every spoke with "No public key found". This Skill pins the agent to field-verified Junos syntax and known workarounds so ADVPN designs actually commit and shortcuts actually form. ## Core Features & Use Cases - ADVPN design and configuration: Produces complete hub (suggester) and spoke (partner) configurations with multipoint st0, OSPF p2mp with dynamic-neighbors, and certificate-based IKEv2. - PKI enrollment guidance: Walks through keypair generation, CSR signing, and certificate loading, including the chassis-cluster RG0-primary gotcha. - Troubleshooting matrix: Maps symptoms like NAT-T 4500 retransmits, missing shortcuts, and the vSRX3 dynamic-gateway "No public key found" defect to root causes and fixes. - Use Case: A network engineer building a 12-branch ADVPN overlay on vSRX3 uses this Skill to generate the hub and spoke configs, enroll certificates, and diagnose why spoke IKE_AUTH fails on the dynamic gateway. ## Quick Start Use the srx-advpn skill to design an ADVPN hub-and-spoke deployment with certificate authentication and OSPF over a multipoint st0 overlay.

Frequently Asked Questions about srx-advpn

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure Juniper SRX ADVPN with certificates?▼

Configure a multipoint numbered st0 unit, an IKEv2 gateway with certificate authentication and the appropriate ADVPN role (suggester on the hub, partner on spokes), and an IPsec VPN bound to st0.1 without traffic selectors. Run OSPF point-to-multipoint with dynamic-neighbors over the overlay so shortcuts trigger reconvergence.

Why does SRX ADVPN fail with pre-shared-keys at commit?▼

On Junos 24.4R1 and 25.4R1, IKEv2 with pre-shared-keys fails commit whenever dynamic ike-user-type (group-ike-id or shared-ike-id) is configured. ADVPN's group model therefore requires RSA or ECDSA certificate authentication; plan PKI enrollment first.

Why does SRX IKE_AUTH fail with "No public key found"?▼

On vSRX3 24.4R1/25.4R1, the dynamic-gateway certificate responder path never hands the peer CERT to pkid, so signature verification fails for every spoke. The workaround is per-spoke static-address certificate gateways on the hub, which use the working responder path.

ADVPN vs AutoVPN vs static hub-and-spoke: which should I use?▼

Use ADVPN when branch-to-branch traffic justifies dynamic spoke-to-spoke shortcuts and PKI is available. Use AutoVPN full-tunnel for centralized egress and inspection, and static point-to-point hub-and-spoke for a small, stable set of sites.

Why do SRX IPsec tunnels retransmit IKE_AUTH on UDP 4500?▼

Two common causes: double NAT in the underlay drops the 4500 return path, or the initiator's untrust zone lacks host-inbound-traffic system-services ike. Collapse to a single NAT hop and permit IKE inbound on every node's WAN zone.

Why does SRX certificate loading fail on a chassis cluster?▼

The request security pki local-certificate load command runs on the RG0-primary node, so it fails if the keypair was generated on the other node. Fail redundancy-group 0 over to the node holding the keypair, then load the certificate.

Related Skills

Explore More Software Engineering Skills→
automateyournetworkautomateyournetwork
650

vault-pki

Manage HashiCorp Vault PKI certificate issuers, roles, and certificate lifecycle operations.

Community
Basic
dgethingsdgethings

pyats-junos-routing

Automate JunOS routing verification across OSPF, BGP, MPLS, and route tables using pyATS.

Community
Advanced
rloisellrloisell
7

network-security

Define ACLs, NAT/PAT, IPsec VPNs, and zone-based firewall policies for Cisco IOS/IOS-XE and Linux iptables.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

hub-and-spoke

Coordinate a central hub to spawn and manage parallel spokes.

Official
Advanced